Re: TCP Timestamp Vulnerability

[christos%astron.com@localhost (Christos Zoulas)]

In article <000901d3c785$7e7486a0$7b5d93e0$@seqent.com>,
Richard Sass <richard.sass%seqent.com@localhost> wrote:
>	"The remote host implements TCP timestamps, as defined by RFC1323. A
>side effect of this feature is that the uptime of the remote host can be
>sometimes be computed."
>
>Additional: http://www.securiteam.com/securitynews/5NP0C153PI.html
>
>I think the thought behind this is that if a person can determine the uptime
>of a system then this might be additional information that could be used to
>target an attack. For example: if a system has been up for a year then it
>probably hasn't been patched with recent security patches giving the
>attacker another piece of information on how to attack the system. I'm not
>sure if there may be more to it than that.

Oh no, not this again :-)

https://mail-index.netbsd.org/tech-net/2016/07/20/msg006018.html

And we have not had the uptime issue in ~forever; look at how "tcp_now" is
computed.

christos